v2.0.4

Encrypted secret bundles now support an optional SHA-256 checksum. The app checks the bundle's header, exact length, and any available checksum before enabling the password field, so damaged or incomplete bundles report an integrity error instead of an ambiguous unlock failure. Cached checksums are verified offline.

The encrypted archive format is unchanged: older apps can still read newly created bundles, and updated apps accept older bundles without checksums. Successful legacy unlocks save a local checksum when the drive is writable. AES-GCM authentication remains required; a checksum does not authenticate the publisher or replace the password.

The administrator tool creates .sha256 sidecars alongside new or rekeyed archives. Its new checksum command authenticates an existing archive before adding a sidecar without changing its encrypted bytes or password; verify checks length and any checksum without a password. Serve Secrets.aqsecrets.sha256 beside the matching Secrets.aqsecrets on nettools. The drive-copy helper verifies and copies an accompanying sidecar when an archive is explicitly supplied.

Validation: all 65 .NET 10 tests and 61 .NET 6 tests passed, including compatibility and corrupted-download checks. The app builds, PowerShell 5.1 helper checks passed, and dev build 2.0.4.1 with a matching cached checksum was confirmed working on a test imaging drive.